Method for carrying out number multiplication operation under secret state condition and computing equipment

Abstract

According to the method for carrying out number multiplication operation under the secret state condition and the computing device, a first participant divides N to-be-computed scalar quantities into m groups, arrangement is carried out on each group of to-be-computed scalar quantities to obtain a corresponding to-be-coded vector, each to-be-coded vector is obtained by splicing m identical first vectors and second vectors, and m is an integer greater than or equal to 1; the first vector and the second vector are each composed of a to-be-calculated scalar, the m to-be-coded vectors are coded to obtain m plaintext polynomials, non-zero coefficient items of the m plaintext polynomials are extracted and spliced to obtain a fusion polynomial, the fusion polynomial is encrypted by using a homomorphic encryption algorithm to obtain a fusion ciphertext, and the fusion ciphertext is used for decoding the fusion ciphertext. Transmitting the fused ciphertext to the second participant; and the second participant determines a cryptographic operation result of the number multiplication operation according to the fused ciphertext and m combined polynomials by using a homomorphic encryption algorithm, the combined polynomials are obtained by encoding combined vectors, and the combined vectors are obtained by arranging mutually independent to-be-calculated vectors according to the to-be-encoded vectors, so that the overhead of the number multiplication operation can be reduced.

Description

A method and computing device for performing scalar multiplication under dense conditions. Technical Field

[0001] The embodiments in this specification belong to the field of data processing technology, and in particular relate to a method and computing device for performing scalar multiplication under dense conditions. Background Technology

[0002] In privacy-preserving computation scenarios, each participating party needs to ensure that its private data is not leaked to other parties while completing various computational tasks such as model training, joint statistics, and privacy matching. Therefore, homomorphic encryption algorithms, due to their ability to support homomorphic operations on ciphertext (the result of a homomorphic operation on ciphertext is equivalent to the result of a direct arithmetic operation on the plaintext), are often used to support various computational tasks in multi-party secure computation scenarios.

[0003] Currently, homomorphic encryption algorithms based on the Ring Learning With Errors (RLWE) problem are a major category of solutions used in privacy-preserving computing scenarios. Mainstream implementations of this type of homomorphic encryption algorithm include the Brakerski-Fan-Vercauteren (BFV) scheme, the Brakerski-Gentry-Vaikuntanathan (BGV) scheme, the Cheon-Kim-Kim-Song (CKKS) scheme, the Fastest Homomorphic Encryption in the West (FHEW) scheme, and the Fully Homomorphic Encryption over the Torus (TFHE) scheme.

[0004] Among them, the construction ideas of the BFV scheme, the BGV scheme, and the CKKS scheme are highly similar. The objects they encrypt (i.e., the plaintext corresponding to a ciphertext after encryption) are all polynomials. That is, regardless of the actual form in which the original data to be calculated in the application scenario is represented, if it is necessary to use the above three schemes (hereinafter, the BFV scheme, the BGV scheme, and the CKKS scheme are collectively referred to as the polynomial encryption scheme) to encrypt the original data (usually, the original data is represented in the form of scalars, vectors, matrices, high-dimensional tensors, etc. However, both matrices and high-dimensional tensors can be regarded as composed of multiple vectors arranged. Therefore, in the following, only the cases where the original data is a scalar or a vector are considered), then the original data needs to be encoded into polynomial form first. By virtue of this property, the polynomial encryption scheme can achieve Single Instruction, Multiple Data (SIMD) packing - encoding multiple plaintext scalars into different slots of a plaintext polynomial, and then encrypting the plaintext polynomial is equivalent to encrypting multiple plaintext scalars at once. Furthermore, not only can multiple plaintext scalars be encoded in a plaintext polynomial, but multiple plaintext vectors can also be encoded (assuming that the plaintext polynomial to be encrypted is set to have N slots - that is, the plaintext polynomial has N terms, then the plaintext polynomial needs to be encoded by a plaintext vector of length N. When the actual length of the original vector to be calculated in the computing task is m (m < N), original vectors of length m can be concatenated into a combined vector of length N, encoded as a plaintext polynomial and encrypted, and original vectors are stored in one ciphertext). Furthermore, performing a homomorphic operation on a ciphertext is equivalent to performing the same arithmetic operation on original vectors simultaneously. Compared with encrypting only one plaintext scalar in a ciphertext (the objects encrypted by the FHEW scheme and the TFHE scheme are both one plaintext scalar), its computing efficiency has increased exponentially. Therefore, the polynomial encryption scheme is also commonly used in tasks such as model training.

[0005] There is such a specific scenario in privacy computing - Party A holds a batch of vectors, and Party B holds a batch of scalars. Party A and Party B need to perform scalar-vector multiplication under encryption (for example, when training a model or making predictions using a model, the weight parameters of the Batch Normalization layer in the model are held by Party B, and the feature vectors corresponding to the sample data are held by Party A. If it is necessary to calculate the result of the feature vector processed by the Batch Normalization layer, then a multiplication operation between a scalar and a vector needs to be performed.).

[0006] Continuing with the previous example, in the existing technology, there are two implementation methods for scalar multiplication under encrypted conditions. One method involves Bob encrypting his plaintext scalar and sending it to Alice, who then performs plaintext-ciphertext multiplication to obtain the encrypted result. The other method involves Alice encrypting her plaintext vector and sending it to Bob, who then performs plaintext-ciphertext multiplication to obtain the encrypted result. The computational cost, communication cost, and computational results of these two methods are identical. However, since the latter method has no room for optimization, for ease of comparison with this embodiment, the following description will only use the former method (where Bob encrypts his plaintext scalar and sends it to Alice) as an example to illustrate the implementation of scalar multiplication in the existing technology.

[0007] To facilitate understanding of existing technology, a brief introduction to the encoding process of polynomial encryption schemes is provided first. As mentioned earlier, polynomial encryption schemes only support the encryption of plaintext in polynomial form. Therefore, if the original data is not in polynomial form, it is necessary to encode the original data into polynomial form before encryption. Specifically, the plaintext space of a polynomial encryption scheme is typically represented as follows: The plaintext space is a polynomial ring, indicating that the plaintext encrypted by the polynomial encryption scheme is a polynomial with a degree less than N and coefficients modulo t. Therefore, to encode a vector of length N into a polynomial in the plaintext space, each element of the vector can be considered as N function values ​​of the polynomial in point-value representation (each function value corresponds to a primitive root of unity modulo t). Then, based on the N sets of function values ​​and primitive roots (primitive roots of unity), the N coefficients corresponding to the N terms (including the zeroth degree term) of the polynomial in coefficient representation are calculated, thus completing the vector-to-polynomial encoding. This encoding method is also known as the Inverse Number Theoretic Transform (iNTT). Clearly, a polynomial with N terms is encoded from a vector of length N. That is, when the plaintext space is set to... At that time, a plaintext polynomial can encode and store N plaintext scalars or A plaintext vector of length m.

[0008] Next, we will briefly introduce plaintext-ciphertext multiplication in polynomial encryption schemes. Generally speaking, when the plaintext space of a polynomial encryption scheme is... The corresponding ciphertext space will then be represented as (A ciphertext consists of two fragments), where In other words, the ciphertext fragments in a polynomial encryption scheme are also represented as polynomials. The difference between the ciphertext space and the plaintext space is that q is much greater than t, meaning the modulus of the coefficients in the ciphertext fragments (or ciphertext polynomials) is much larger than that in the ciphertext. Plaintext-ciphertext multiplication in polynomial encryption schemes is implemented using polynomial multiplication, as shown in Figure 1. The plaintext polynomial α is derived from the plaintext vector... Encoded, ciphertext From plaintext vector Encoded as plaintext polynomial After encryption, the plaintext polynomial α and the ciphertext ( The result of the multiplication is obtained by using polynomial multiplication. The result of multiplication The plaintext vector obtained after decryption and decoding ,Right now The elements in it are equal to and The plaintext-ciphertext multiplication is performed element-wise. In other words, the plaintext-ciphertext multiplication in a polynomial encryption scheme can achieve (or can only achieve) the computational effect of multiplying the plaintext vector... Plaintext vector corresponding to ciphertext Perform positional multiplication.

[0009] Based on the above calculation results of plaintext-ciphertext multiplication, Figure 2 shows a schematic diagram of the scalar multiplication operation under encrypted conditions in the prior art. As shown in Figure 2, the complete process requires the joint participation of Alice and Bob. Let m be the length of each vector held by Alice, N be the number of terms in the plaintext polynomial set by the polynomial encryption scheme, and d be the number of vectors held by Alice and the number of scalars held by Bob. Let d be the number of vectors held by Alice. Then the scalar quantity held by Bob is denoted as The computational task is to compute... To accomplish the above computational task, Bob needs to encrypt his own scalar and send it to Alice, so that Alice can perform a scalar multiplication operation using the encrypted scalar and the vector of his plaintext state.

[0010] To implement this scalar multiplication operation using plaintext-ciphertext multiplication in polynomial encryption schemes, as shown in Figure 2, the strategy employed by Bob in the prior art is to use its own scalar... Fill with repeating numbers ( A vector of length m composed of ) Then utilize each vector After concatenation, a vector of length N to be encoded is obtained. Each vector to be encoded is then composed of... indivual Vector composition (concatenation) (Since the vector indices are all different), Bob will get There are 4 vectors to be encoded. For example, in Figure 2, when N=8, m=2, and d=8, then one vector to be encoded consists of 4 vectors. The vectors are composed of vectors, and the vectors to be encoded are respectively and .

[0011] Bob then encodes each combined vector to obtain... A plaintext polynomial is obtained; and each plaintext polynomial is encrypted to obtain... Each ciphertext consists of two pieces, each of which is a ciphertext polynomial.

[0012] Ultimately, Bob will The encrypted message is transmitted to Alice. Alice then processes the vector she holds using Bob's method of constructing the received encoded vector. The vectors are also concatenated to obtain several combined vectors, which correspond to each ciphertext. A combination vector (specifically, for a corresponding pair of ciphertext and combination vectors, the combination vector and the vector to be concatenated corresponding to the ciphertext have the same position in the vector to be concatenated). Vector and Vectors have the same subscript; for example, if a ciphertext is composed of... The ciphertext is obtained by further encryption after encoding (in the following text, if a ciphertext is obtained by further encryption after encoding a vector, it is said that the vector is encrypted in the ciphertext), then the combined vector corresponding to the ciphertext is: .

[0013] Therefore, Alice continues to encode each combination vector to obtain the combination polynomial corresponding to each combination vector. By performing plaintext-ciphertext multiplication on the combination polynomial and its corresponding ciphertext (the implementation of this plaintext-ciphertext multiplication can be found in the description above), the following can be obtained: The result of the operation.

[0014] Based on the previous introduction to plaintext-ciphertext multiplication, the plaintext vector obtained after decrypting and decoding each operation result is the result of the scalar multiplication operation. … .

[0015] As can be seen from the above description of Figure 2, in the complete scalar multiplication process, Bob needs to perform... The vectors to be encoded are processed Secondary encoding, and corresponding processing Second encryption, transmitting to Alice A ciphertext with N slot bits.

[0016] This embodiment provides a scheme for performing scalar multiplication under dense conditions, which can reduce the computational and communication overhead in the above process. Summary of the Invention

[0017] This specification provides an embodiment of a method and computing device for performing scalar multiplication under dense conditions, including:

[0018] This specification provides a method for performing scalar multiplication under dense conditions. The method involves a first participant and a second participant, the first participant holding a scalar to be computed, and the second participant holding a vector to be computed, the length of the vector being computed being m. The method includes:

[0019] The first participant divides N independent scalars to be computed into m groups, and arranges the scalars to be computed in each group to obtain a corresponding vector to be encoded. For any vector to be encoded, it is obtained by concatenating m identical first vectors and m identical second vectors. Both the first vectors and the second vectors are derived from... It consists of several independent scalars to be calculated;

[0020] The first participant encodes each of the m vectors to be encoded, resulting in m plaintext polynomials;

[0021] The first participant extracts the non-zero coefficient terms of the m plaintext polynomials and concatenates them to obtain a fused polynomial.

[0022] The first participant uses a homomorphic encryption algorithm to encrypt the fusion polynomial to obtain the fusion ciphertext;

[0023] The first participant transmits the fused ciphertext to the second participant;

[0024] The second participant uses the homomorphic encryption algorithm to determine the encrypted result of the scalar multiplication operation based on the fused ciphertext and m combination polynomials, wherein the combination polynomials are obtained by encoding combination vectors, and each combination vector is generated by... The independent vectors to be computed are arranged according to the arrangement method of the vectors to be encoded.

[0025] A second aspect of this specification provides a computer-readable storage medium having a computer program stored thereon that, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0026] A third aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the first aspect.

[0027] The scheme for performing scalar multiplication under dense conditions provided in this embodiment can reduce the computational and communication overhead of performing scalar multiplication under dense conditions. Attached Figure Description

[0028] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 is a schematic diagram illustrating the calculation effect of plaintext-ciphertext multiplication provided in this manual;

[0030] Figure 2 is a schematic diagram of the process of performing scalar multiplication under dense state conditions in the prior art provided in this specification;

[0031] Figure 3 is a flowchart illustrating a method for performing scalar multiplication under dense conditions in one embodiment of this specification;

[0032] Figure 4 is a schematic diagram of the important properties of the coding process provided in this manual;

[0033] Figure 5 is a schematic diagram of the process of fusing plaintext polynomials in one embodiment of this specification;

[0034] Figure 6 is a flowchart illustrating a specific computational task in one embodiment of this specification. Detailed Implementation

[0035] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0036] Figure 3 shows a flowchart of a method for performing scalar multiplication under encrypted conditions according to an embodiment of this specification. The method involves two participants—a first participant and a second participant (for ease of comparison with the prior art, the first participant can be compared with participant Bob, and the second participant with participant Alice, to compare this embodiment with the prior art). The first participant holds multiple scalars to be calculated, and the second participant holds multiple vectors to be calculated. The task objective of the first and second participants is to perform scalar multiplication between the multiple scalars to be calculated and the multiple vectors to be calculated under encrypted conditions.

[0037] The method includes the following steps:

[0038] Step S301: Divide the N independent scalars to be computed into m groups, and arrange the scalars to be computed in each group to obtain the corresponding encoding vector. For any encoding vector, the encoding vector is obtained by concatenating m identical first vectors and m identical second vectors. Both the first vector and the second vector are derived from... It consists of a set of independent scalars to be calculated.

[0039] First, it should be noted that, following the introduction in the background section, this specification denotes the number of scalars to be calculated held by the first participant and the number of vectors to be calculated held by the second participant in the embodiment as 'd', and the length of the vectors to be calculated as 'm'. The number of slots in the plaintext polynomial to be encrypted in the homomorphic encryption algorithm used in this embodiment is denoted as 'N'. The method shown in Figure 3 only illustrates the specific implementation of scalar multiplication under encrypted conditions when d=N (when d=N, step S303 will only concatenate to obtain a fused polynomial, and correspondingly, step S305 will only encrypt to obtain a fused ciphertext). It should be understood that when d>N, the scalar multiplication operation for all scalars and vectors to be calculated can be achieved simply by repeatedly executing the method shown in Figure 3. The following description will also use a form that does not impose specific restrictions on the number of scalars to be calculated (i.e., this embodiment does not restrict the value of d).

[0040] As described in the introduction of existing technologies, due to the limitations of the plaintext-ciphertext multiplication implementation method in polynomial encryption schemes, encrypting d scalars to be computed into ciphertext requires N slots (i.e., the number of slots in the plaintext polynomial to be encrypted) in the homomorphic encryption algorithm. The d scalars to be computed are stored in ciphertext. Therefore, this embodiment provides an arrangement method that only requires... Each ciphertext can store d scalars to be computed. Specifically, this arrangement method involves step S301 (arranging the scalars to be computed to obtain the vector to be encoded), step S305 (arranging the plaintext polynomial to obtain the fused polynomial), and step S311 (arranging the vector to be computed accordingly). To clearly explain this arrangement method, an important property of the encoding method (encoding the vector into a polynomial) will be introduced first below.

[0041] By observing the encoding process, it can be found that for plaintext polynomials... ( (The definition can be found in the background section.) Encodes vectors ( Representing vectors The vector has a length of N, and the elements of each term are modulo t, where , ,So If and only if .

[0042] The important properties mentioned above can be visualized as follows: if a vector of length N... Its first half (the first N / 2 elements) consists of a short vector of length K / 2. The concatenation yields the last N / 2 elements, which are derived from another short vector of length K / 2. If it is pieced together, then After encoding, the resulting polynomial has only K non-zero coefficients, and these non-zero coefficients are sparsely and uniformly distributed. On these items. Referring to Figure 4, when N=8 and K=4, , ,vector Encoding results Only items 1, 3, 5, and 7 (i.e. item, item, item, The coefficient of the term is a non-zero coefficient.

[0043] Due to plaintext polynomials The non-zero coefficients are sparsely and uniformly distributed, allowing for the calculation of non-zero coefficients without loss of information. a plaintext polynomial It is possible to arrange all non-zero coefficients into a polynomial where all coefficients are non-zero (see the description of step S305 for details on this arrangement method). Therefore, the number of polynomials requiring encryption can be drastically reduced.

[0044] Of course, in order for the encoded plaintext polynomial to satisfy the above plaintext polynomial... The important properties it possesses first require the arrangement of the scalars to be calculated to obtain the corresponding... A vector in the form of vectors. In this embodiment, step S301 is used to arrange the scalars to be calculated accordingly.

[0045] First, it should be noted that the scalar multiplication operation in the subsequent steps (step S311) is actually a plaintext-ciphertext multiplication between the vector to be calculated in plaintext form and the scalar to be calculated in ciphertext form. According to the characteristics of plaintext-ciphertext multiplication, in order to realize the scalar multiplication operation, the number of times the same scalar to be calculated appears in the ciphertext must be the same as the length of the vector to be calculated. Therefore, when arranging, the same scalar to be calculated needs to appear m times in a vector to be encoded (m is the length of the vector to be calculated).

[0046] Referring to the aforementioned important properties, the first vector and the second vector in this embodiment can correspond to the vectors described in those important properties. , If a set of scalars to be computed is divided into two halves and placed into a first vector and a second vector respectively, the number of the first vector (or the second vector) in the vector to be encoded is the number of times a scalar to be computed appears repeatedly in this embodiment. Therefore, the number of the first vector (or the second vector) (i.e., the parameter in the important properties section) is... The length of the vector to be calculated must be the same as the length of the vector to be calculated. Therefore, based on the number of the first vector (or the second vector) and the length of the vector to be encoded, the length K / 2 of the first vector (or the second vector) can be determined accordingly. In this embodiment, the number of independent scalars that can be arranged for a vector to be encoded is the sum of the lengths of the first vector and the second vector. .

[0047] Therefore, the first participant can [receive] each Each independent scalar to be computed is grouped into a set. For any given set of scalars, the set is divided into two halves, each half consisting of a length of... The first vector, the other half of which forms a length of The second vector is obtained by repeatedly concatenating the first vector with itself. The length obtained is The first vector is used to repeatedly concatenate the second vector with itself. The length obtained is The rear vector is obtained by concatenating the front vector with the rear vector to obtain the scalar vector of length N to be encoded.

[0048] Based on the total number d of the scalars to be calculated, the scalars to be calculated can be divided into: The group, and the corresponding steps in S301, can be programmed to obtain One vector to be encoded

[0049] Step S303: The first participant encodes each of the m vectors to be encoded to obtain m plaintext polynomials.

[0050] After arranging the corresponding vectors to be encoded based on each set of scalars to be calculated, the first participant can encode each vector to determine the plaintext polynomial corresponding to each vector. That is, when the number of vectors to be encoded is... In this embodiment, the number of plaintext polynomials is also [number]. indivual.

[0051] The method used to encode the vector to be encoded can be the iNTT algorithm described above, which will not be elaborated on here.

[0052] Step S305: The first participant extracts the non-zero coefficient terms of the m plaintext polynomials and concatenates them to obtain the fused polynomial.

[0053] After determining the plaintext polynomial corresponding to each vector to be encoded, the first participant can fuse the plaintext polynomials to obtain several fused polynomials.

[0054] Specifically, referring to the aforementioned important properties, after the arrangement in step S301, the vector to be encoded already conforms to the vector... If the plaintext polynomial obtained by encoding the vector to be encoded is in the form of a polynomial, then the plaintext polynomial obtained by encoding the vector to be encoded also conforms to the polynomial form. In this embodiment, only one of every m terms in a plaintext polynomial is a non-zero coefficient, and since the vector to be encoded corresponding to each plaintext polynomial has undergone the same encoding process, the positions of the non-zero coefficients of each plaintext polynomial are the same.

[0055] Therefore, in this embodiment, every m plaintext polynomials can be fused, and the non-zero coefficient terms of these m plaintext polynomials can be extracted and fused to obtain a fused polynomial. That is, when there are a total of When fusing plaintext polynomials, the result can be obtained. A fusion polynomial.

[0056] Figure 5 shows a flowchart illustrating the fusion of plaintext polynomials in one embodiment of this specification. As shown in Figure 5, when N=8, m=2, and d=8, if it is necessary to fuse plaintext polynomials... To merge two plaintext polynomials, simply multiply either plaintext polynomial by 1 / 2. This allows for the shifting of the non-zero coefficient terms of the plaintext multiplication factor to the higher bits by n bits (Figure 5 only shows the shift of the non-zero coefficient terms of the plaintext multiplication factor). By performing a 1-bit shift to the higher-order bits, and then adding the shifted plaintext polynomial to the unshifted plaintext polynomial, the fused polynomial can be obtained. It should be noted that since the plaintext polynomial is represented on a polynomial ring, the degree of the plaintext polynomial is modulo 1. Therefore, the result will not result in a polynomial with more than N terms after the shifting process.

[0057] In general, for m plaintext polynomials, multiplying these m plaintext polynomials by the 0th, 1st, ..., m-1th powers of X respectively yields m shift polynomials (the plaintext polynomial multiplied by the 0th power of X is actually shifted, and is also called a shift polynomial for convenience). Adding the m shift polynomials together achieves the misaligned addition of the m plaintext polynomials to obtain the fused polynomial corresponding to the m plaintext polynomials.

[0058] It is important to note that the main difference between this embodiment and the prior art lies in this aspect of computational overhead. In the prior art, during encoding... After generating a plaintext polynomial (the arrangement of plaintext polynomials in the prior art is different from that in this embodiment), then directly... Encrypting a plaintext polynomial requires... In this embodiment, the plaintext polynomial is fused according to step S305 to obtain the next encryption. A fusion polynomial, thus requiring only the fusion polynomial to be processed in subsequent steps. This is a secondary encryption. Since the number of terms in the fusion polynomial is the same as that in the plaintext polynomial, the computational cost of encrypting a fusion polynomial is the same as that of encrypting a plaintext polynomial. In this embodiment, the encryption process overhead is only that of existing technologies. .

[0059] Step S307: The first participant uses a homomorphic encryption algorithm to encrypt the fusion polynomial to obtain the fusion ciphertext.

[0060] After obtaining a number of fusion polynomials, the first participant can use a homomorphic encryption algorithm to encrypt each polynomial, obtaining the fusion ciphertext corresponding to each fusion polynomial. That is, when the number of fusion polynomials is... The number of fused ciphertexts obtained by encrypting in step S307 is also [number]. indivual.

[0061] The homomorphic encryption algorithm referred to in step S307 can correspond to any of the aforementioned polynomial encryption schemes (BFV, BGV, and CKKS schemes), or it can be other homomorphic encryption schemes derived from the aforementioned polynomial encryption schemes, provided that the homomorphic encryption algorithm is constructed according to the RLWE problem and the plaintext space is a polynomial space. Furthermore, the first participant can use the same public key to encrypt all fusion polynomials, or it can use several public keys to encrypt different fusion polynomials separately; this specification does not impose any restrictions here.

[0062] It is important to note that, in order to ensure the confidentiality of the ciphertext for the scalar to be computed, the private key used by the first participant must not be known by the second participant.

[0063] Step S309: The first participant transmits the fused ciphertext to the second participant.

[0064] After determining the fusion ciphertext corresponding to each fusion polynomial, the first participant can transmit each fusion ciphertext to the second participant. It should be noted that the number of fusion polynomials is only equal to the number of plaintext polynomials. The number of fused ciphertexts obtained in this embodiment is only a fraction of the number of ciphertexts in existing technologies. Accordingly, in this embodiment, The communication overhead for transmitting a large number of encrypted messages is also only that of existing technologies. .

[0065] Step S311: The second participant uses the homomorphic encryption algorithm to determine the encrypted result of the scalar multiplication operation based on the fused ciphertext and m combined polynomials, wherein the combined polynomials are obtained by encoding combined vectors, and each combined vector is encoded by... The independent vectors to be computed are arranged according to the arrangement method of the vectors to be encoded.

[0066] After receiving the ciphertexts transmitted by the first participant, the second participant can perform plaintext-ciphertext multiplication operations with each vector to be calculated held by itself and each fused ciphertext to determine the encrypted operation result of the scalar multiplication operation between the multiple scalars to be calculated held by the first participant and the multiple vectors to be calculated held by itself.

[0067] Specifically, the first participant can inform the second participant in advance of the correspondence between the fused ciphertext and the scalar to be computed, as well as the necessary parameters of the homomorphic encryption algorithm (such as the number of slots N, the modulus t of the plaintext space, the modulus q of the ciphertext space, the key used for automorphism, etc.). Thus, the second participant can determine how to select the corresponding vector to be computed for each fused ciphertext to perform plaintext-ciphertext multiplication.

[0068] Additionally, it should be noted that, since this embodiment arranges the scalar to be calculated and the plaintext polynomial in steps S301 and S305 respectively, in step S311, the fused ciphertext needs to be reversed in accordance with step S305, and the vector to be calculated needs to be arranged in accordance with step S301, so that the scalar multiplication operation effect can be achieved by using plaintext-ciphertext multiplication.

[0069] Specifically, in step S311, the homomorphic encryption algorithm is used to split the fused ciphertext and determine m extended ciphertexts, wherein each extended ciphertext is equal to a plaintext polynomial after decryption; the homomorphic encryption algorithm is used to perform plaintext-ciphertext multiplication on each extended ciphertext and the corresponding combination polynomial to determine the encrypted operation result corresponding to each extended ciphertext.

[0070] As can be seen from step S305, in this embodiment, the fused polynomial is obtained by adding multiple plaintext polynomials in a staggered manner. However, this fused polynomial has no explicit meaning—the process of encoding the vector to be encoded into a plaintext polynomial is reversible (by performing a number-theoretic transformation (NTT) on the plaintext polynomial, it can be decoded into the corresponding vector to be encoded), but further transformation of the plaintext polynomial will destroy the information structure in the plaintext polynomial, making the encoding process no longer reversible. Imagine that decoding the fused polynomial will still result in a vector of length N, and a vector of length N cannot represent m vectors of length N to be encoded.

[0071] However, in homomorphic encryption algorithms, for a fusion polynomial, there is a positional correspondence between the fusion polynomial and the fusion ciphertext obtained by encrypting the fusion polynomial (as mentioned above, a ciphertext consists of two ciphertext polynomials). Transforming the position of the fusion ciphertext polynomial is equivalent to transforming the fusion polynomial accordingly (i.e., decrypting the ciphertext after the position transformation, the decryption result is equal to transforming the fusion polynomial accordingly).

[0072] Therefore, in this embodiment, splitting the fused ciphertext to obtain the extended ciphertext is equivalent to splitting the fused polynomial into a plaintext polynomial in the encrypted state.

[0073] Specifically, for any plaintext polynomial, the mask polynomial corresponding to the plaintext polynomial is determined based on the position of the non-zero coefficient terms of the plaintext polynomial in the fusion polynomial; the fusion ciphertext is then masked based on the mask polynomial corresponding to the plaintext polynomial to determine the extended ciphertext corresponding to the plaintext polynomial.

[0074] For any plaintext polynomial, the mask position corresponding to the plaintext polynomial must first be determined (i.e., which non-zero coefficients in the fused polynomial belong to the plaintext polynomial (and need to be retained), and which non-zero coefficients do not belong to the plaintext polynomial (and do not need to be retained)). Then, the corresponding mask polynomial is determined based on the mask position. The determination of the mask polynomial can refer to the Oblivious Expansion method in the prior art.

[0075] Subsequently, plaintext-ciphertext multiplication is performed between the masked polynomial and the fused ciphertext to obtain the offset ciphertext corresponding to the plaintext polynomial. It should be noted that although the offset ciphertext only retains the non-zero coefficients corresponding to the plaintext polynomial, the positions of these non-zero coefficients are those after the shift in step S305 (i.e., the offset ciphertext is equivalent to encrypting the shifted plaintext polynomial). Therefore, the offset ciphertext still needs to be shifted through automorphism to obtain the extended ciphertext, which is equivalent to directly encrypting the plaintext polynomial. Referring again to Figure 5, if the fused ciphertext is directly masked, after masking terms 1, 3, 5, and 7, the remaining plaintext polynomial is... The corresponding coefficient terms. However, due to the original... The non-zero coefficient terms in the plaintext are located in terms 1, 3, 5, and 7, while the non-zero coefficient terms in the masked fused ciphertext (i.e., the offset ciphertext) are located in terms 2, 4, 6, and 8. The plaintext polynomial actually corresponding to the offset ciphertext is... Therefore, the offset ciphertext also needs to be shifted to adjust the non-zero coefficient terms back to terms 1, 3, 5, and 7.

[0076] Here, we will briefly explain automorphism. Automorphism is a type of operation in homomorphic encryption schemes. It can rearrange the plaintext slots (which can be obtained by decrypting and decoding the ciphertext) by processing the ciphertext. Its implementation utilizes the special property of primitive roots in homomorphic encryption schemes (the result of raising a primitive root to a specific power is equal to itself). Since this embodiment only uses automorphism to shift the offset ciphertext without improving the implementation method of automorphism, it will not be elaborated here.

[0077] For a given ciphertext, performing the above process m times will yield m extended ciphertexts corresponding to that ciphertext, and then for... ciphertext, totaling 1 ciphertext, requires 1 ciphertext. Sub-verbal-ciphertext multiplication and The automorphism (in step S305, each fusion polynomial contains an unshifted plaintext polynomial) can split all the ciphertext into extended ciphertext.

[0078] After obtaining each extended ciphertext, the second participant can determine several vectors to be calculated corresponding to each vector to be encoded based on the correspondence between the scalar to be calculated and the vector to be calculated when performing scalar multiplication. For any scalar to be calculated in any vector to be encoded, the position of each element in the vector to be calculated that performs scalar multiplication with the scalar to be calculated in the combined vector obtained after arrangement is determined based on the position of the scalar to be calculated in the vector to be encoded.

[0079] Specifically, for any scalar to be calculated, based on the position of the scalar to be calculated in the vector to be encoded during the arrangement of the scalar to be calculated in step S301, the elements of the vector to be calculated that need to be multiplied by the scalar to be calculated are arranged to the same position at the end of the combined vector. Thus, by performing plaintext-ciphertext multiplication on each combined vector obtained by the arrangement and the corresponding extended ciphertext (i.e., the scalar multiplication object of each vector to be calculated in the combined vector), the encrypted operation result of the scalar multiplication operation between the multiple scalars to be calculated held by the first participant and the multiple vectors to be calculated held by the second participant can be obtained.

[0080] Since both the first and second participants know the arrangement method of the vector to be encoded, after decrypting the result of the encrypted operation, the result of the scalar multiplication operation in the plaintext state can be obtained by extracting data according to the arrangement method.

[0081] In summary, in this embodiment, under the conditions that the amount of data to be calculated (the number of vectors and scalars to be calculated) is the same, and the preset parameters (number of slots N) of the homomorphic encryption algorithm are the same, the number of ciphertexts that the first participant needs to encrypt and transmit is only a fraction of that in existing technologies. (existing technology is) This embodiment is only for... (times), and correspondingly, the computational and communication overhead of the first participant in this embodiment is far lower than that of the prior art. The additional processing required by the second participant compared to the prior art is only... Sub-verbal-ciphertext multiplication and Since the computational efficiency of plaintext-ciphertext multiplication and automorphism is much higher than that of encryption, even considering both the first and second participants, the overall computational overhead in this embodiment is still much smaller than that of the prior art.

[0082] Figure 3 shows a method for performing scalar multiplication under dense conditions, which can reduce the computational and communication overhead of performing scalar multiplication under dense conditions.

[0083] To more clearly illustrate the specific ideas of this embodiment, the following describes the method for performing scalar multiplication under dense state conditions based on a specific computational task. As shown in Figure 6, in this computational task, the first participant holds 8 scalars to be computed— , , , , , , , The second participant holds 8 vectors to be computed. , , , , , , , The computation task is to perform scalar multiplication on scalars and vectors with the same index; the preset plaintext polynomial slot number is also 8.

[0084] First, the first participant divides the eight scalars to be calculated into two groups based on the length of the vector to be calculated—2. - - - Group 1 - - - (This is the second group), further dividing the four scalars to be calculated in the first group into two, forming the first vector and the second vector respectively. The first vector of the first group. The second vector of the first group, The first vector of the second group. (The second vector of the second group).

[0085] Subsequently, based on the length of the vector to be calculated, the first vector of each group is repeated twice to obtain the corresponding front vector of the group, and the second vector of each group is repeated twice to obtain the corresponding back vector of the group. The front vector and the back vector of each group are concatenated to obtain the vector to be encoded for each group. as well as .

[0086] Furthermore, as explained above, the first and second vectors in this embodiment correspond to the vectors in the important properties. and The vector to be encoded is obtained by arranging the first vector and the second vector. and It also conforms to vectors Therefore, encoding each vector to be encoded yields the form described in the important properties. plaintext polynomials in the form of as well as .

[0087] Then and Perform shifted addition (any plaintext polynomial can be shifted, as shown in Figure 6). (After shifting and adding the results by shifting, we obtain the fused polynomial) .

[0088] After encrypting the fusion polynomial, the first participant can obtain the fusion ciphertext. and will Transmitted to the second participant.

[0089] On the other hand, the second participant also arranges its own vectors to be computed according to the method used by the first participant to arrange the vectors to be encoded. Accordingly, the eight vectors to be computed are divided into two groups based on their lengths. - - - Group 1 - - - (For the second group). Because Need and Perform scalar multiplication, then according to The position in the vector to be encoded is determined. The position of each element in the combined vector. For example, exist If the first and third elements are in the middle, then in the combinatorial polynomial, two elements and They are also located in the combined vector. The first and third positions. Thus, the combined vector is obtained. as well as .

[0090] Then, combine the vectors Encoding yields a combinatorial polynomial Combine vectors Encoding yields a combinatorial polynomial ; will merge ciphertext Decomposed to obtain respectively with and Corresponding extended ciphertext and .

[0091] Finally, perform plaintext-ciphertext multiplication on the corresponding extended ciphertext and the combinatorial polynomial according to the index. , This allows scalar multiplication to be performed.

[0092] In some implementations, after determining the dense state operation result of the scalar multiplication operation, the second participant can further process the dense state operation result using a noisy polynomial to obtain a second slice of the operation result, wherein the noisy polynomial is the first slice of the operation result; and transmit the second slice of the operation result to the first participant.

[0093] According to the background section's description of the specific scenario, the first and second participants do not communicate with each other and neither wants their data to be leaked. If the second participant directly transmits the encrypted operation result to the first participant, the first participant can obtain the complete scalar multiplication result after decryption. Since the first participant already possesses the scalar to be calculated, it can directly obtain the vector to be calculated through the operation result and the scalar to be calculated, which is unacceptable to the second participant. Therefore, the second participant can use a noisy polynomial to process each encrypted operation result (direct addition or subtraction is possible), and transmit the processed result, described as a second fragment, to the first participant, while possessing the noisy polynomial as the first fragment of the operation result. Thus, the first participant cannot recover the corresponding plaintext from the second fragment of the operation result. However, by combining the first and second fragments of the operation result, both parties can still obtain the complete encrypted operation result for use in other computational tasks.

[0094] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0095] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0096] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0097] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0098] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0099] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0100] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0101] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0102] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0103] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0104] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0105] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0106] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0107] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0108] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for performing scalar multiplication under dense-state conditions, the method involving a first participant and a second participant, the first participant holding a scalar to be computed, and the second participant holding a vector to be computed, the length of the vector to be computed being m, the method comprising: The first participant divides N independent scalars to be computed into m groups, and arranges the scalars to be computed in each group to obtain a corresponding vector to be encoded. For any vector to be encoded, it is obtained by concatenating m identical first vectors and m identical second vectors. Both the first vectors and the second vectors are derived from... The first participant encodes m independent scalars to be computed; the first participant encodes each of the m vectors to be encoded to obtain m plaintext polynomials; the first participant extracts the non-zero coefficient terms of the m plaintext polynomials and concatenates them to obtain a fused polynomial; the first participant encrypts the fused polynomial using a homomorphic encryption algorithm to obtain fused ciphertext; the first participant transmits the fused ciphertext to the second participant; the second participant uses the homomorphic encryption algorithm to determine the encrypted operation result of the scalar multiplication operation based on the fused ciphertext and the m combined polynomials, wherein the combined polynomials are obtained by encoding combined vectors, and each combined vector is encoded by... The independent vectors to be computed are arranged according to the arrangement method of the vectors to be encoded.

2. The method as described in claim 1, wherein, The length N of the vector to be encoded is determined according to the number of slots in the plaintext polynomial preset by the homomorphic encryption algorithm.

3. The method as described in claim 1, wherein, The non-zero coefficient terms in each plaintext polynomial are in the same position, and the difference in degree between two adjacent non-zero coefficient terms in each plaintext polynomial is m; extract the non-zero coefficient terms of the m plaintext polynomials and concatenate them to obtain a fused polynomial, specifically including: adding the m plaintext polynomials in a staggered manner to obtain the fused polynomial corresponding to the set of plaintext polynomials.

4. The method as described in claim 1, utilizing the homomorphic encryption algorithm, determines the encrypted operation result of the scalar multiplication operation based on the fused ciphertext and m combined polynomials, specifically including: Using the homomorphic encryption algorithm, the fused ciphertext is split to determine m extended ciphertexts, where each extended ciphertext, after decryption, is equal to a plaintext polynomial. Using the homomorphic encryption algorithm, each extended ciphertext is multiplied by its corresponding combinatorial polynomial using plaintext-ciphertext multiplication to determine the cryptographic operation result for each extended ciphertext.

5. The method as described in claim 4, wherein the fused ciphertext is split to determine m extended ciphertexts, specifically including: For any plaintext polynomial, determine the mask polynomial corresponding to the plaintext polynomial based on the position of the non-zero coefficient terms of the plaintext polynomial in the fusion polynomial; The fused ciphertext is masked according to the mask polynomial corresponding to the plaintext polynomial to determine the extended ciphertext corresponding to the plaintext polynomial.

6. The method as described in claim 5, wherein the fused ciphertext is masked according to the mask polynomial corresponding to the plaintext polynomial to determine the extended ciphertext corresponding to the plaintext polynomial, specifically includes: The fused ciphertext is masked according to the mask polynomial corresponding to the plaintext polynomial to determine the offset ciphertext corresponding to the plaintext polynomial. Based on the number of bits shifted during the misaligned addition of the plaintext polynomial, the offset ciphertext is automorphically transformed to determine the extended ciphertext corresponding to the plaintext polynomial.

7. The method of claim 5, wherein, The combined vectors are arranged according to the following steps: The second participant determines the corresponding vector to be encoded for each vector based on the correspondence between the scalar to be calculated and the vector to be calculated when performing scalar multiplication. There are several vectors to be computed; for any scalar to be computed in any vector to be encoded, the position of each element in the vector to be computed that performs scalar multiplication with the scalar to be computed in the vector to be encoded is determined according to the position of the scalar to be computed in the vector to be encoded. The position of each element in the vector to be computed that performs scalar multiplication with the scalar to be computed in the combined vector obtained after the arrangement is determined.

8. The method of claim 1, further comprising: The second participant processes the dense state operation result using a noisy polynomial to obtain a second slice of the operation result, wherein the noisy polynomial is the first slice of the operation result; the second participant transmits the second slice of the operation result to the first participant.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method as described in any one of claims 1-8.

10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method as claimed in any one of claims 1-8.

Images